CVE-2022-28633

Name of the Vulnerable Software and Affected Versions HPE Integrated Lights-Out 5 (iLO 5) versions prior to 2.71

Description A local disclosure of sensitive information and a local unauthorized data modification issue were discovered. An unprivileged user could locally exploit this to read and write to the iLO 5 firmware file system, resulting in a complete loss of confidentiality and a partial loss of integrity and availability.

Recommendations For versions prior to 2.71, update the firmware to the latest version provided by HPE to resolve the issue. As a temporary workaround, consider restricting access to the iLO 5 firmware file system to minimize the risk of exploitation.